Introduction to Arcjet Rate Limiting

[giscus[bot]]

Introduction to Arcjet Rate Limiting

Arcjet rate limiting lets you control request volume in your app or API, stop abuse and brute-force attacks, and enforce per-user or per-plan quotas without Redis.

https://docs.arcjet.com/rate-limiting

[VinayakGaikwad101]

Does ArcJet consider subdomains as diffrent sites or same site? Suppose there are multiple independent nextjs apps which share a domain(ie, subdomains), so does ArcJet treat them as different sites or as a same site?

[davidmytton]

It's up to you how you define a site. For Arcjet, a site = a single key, but you can use that key across multiple domains/subdomains. We usually see users creating sites per environment e.g. staging or production within a team.

[smndtrl]

From the docs I don't see a way to implement what is written in the examples. E.g. Enforce quotas and usage tiers implies I could set bucket refill based on user/session data. However as one should create the arcjet({}) outside of the request I can't find how to set e.g. refillRate: 50 when session.tier === free but refillRate: 500 when. pro.

What am I missing?

[davidmytton]

Hi @smndtrl - you can do this with ad-hoc rules where you can add rules dynamically.

This creates the Aj client outside the handler and uses a utility function to return an ad-hoc rule depending on the plan. You can then call .protect() within the request handler.

import arcjet, { tokenBucket, shield } from "@arcjet/next";

const aj = arcjet({
  key: process.env.ARCJET_KEY!,
  rules: [
    shield({
      mode: "LIVE", // will block requests. Use "DRY_RUN" to log only
    }),
  ],
});

function getRateLimitByPlan(plan: string) {
  switch (plan) {
    case "free":
      return aj.withRule(
        tokenBucket({
          mode: "LIVE",
          characteristics: ["userId"],
          refillRate: 50,
          interval: 60,
          capacity: 100,
        })
      )
    case "pro":
      return aj.withRule(
        tokenBucket({
          mode: "LIVE",
          characteristics: ["userId"],
          refillRate: 500,
          interval: 60,
          capacity: 400,
        })
      )
    default:
      return aj.withRule(
        tokenBucket({
          mode: "LIVE",
          characteristics: ["userId"],
          refillRate: 5,
          interval: 60,
          capacity: 2000,
        })
      )
  }


  export async function POST(req: Request) {
    // Get the session
    const session = await auth();

    console.log("Session: ", session);

    const decision = await getRateLimitByPlan(session.user.plan).protect(req, {
      requested: 1,
      userId: session.user.id,
    });

    // ...
  }